CVE-2026-10593: memory-safety in zephyrproject zephyr
The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_state() (subsys/bluetooth/audio/bap_unicast_client.c), the handler writes attacker-controlled QoS fields (interval, framing, phy, sdu, rtn, latency, pd) through the stream->qos pointer with only a stream != NULL guard. stream->qos is NULL for any stream that has been codec-configured via bt_bap_stream_config() but not yet added to a unicast group (it is set only by unicast_group_add_stream()). A malicious or buggy remote ASCS server, to which the local device is connected as a BAP unicast client, can send a GATT notification announcing the ASE has entered the QoS Configured state while the local endpoint is still in the Codec Configured state — a transition the dispatcher explicitly permits — during that window, causing a write through a NULL pointer and a crash (denial of service). The data written is itself remote-controlled. The defect shipped in v4.3.0 and v4.4.0 (and earlier). The fix re-points all BAP QoS storage to the always-valid embedded ep->qos struct, eliminating the NULL dereference.
AI Analysis
Technical Summary
The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles ASE state notifications from a remote ASCS server. Specifically, in the function unicast_client_ep_qos_state(), the handler writes attacker-controlled Quality of Service (QoS) fields through a stream->qos pointer that may be NULL if the stream has been codec-configured but not yet added to a unicast group. This results in a NULL pointer dereference and crash when a malicious or buggy remote ASCS server sends a GATT notification indicating the ASE has entered the QoS Configured state prematurely. The defect was present in Zephyr versions 4.3.0 and earlier. The fix involves redirecting all BAP QoS storage to a guaranteed valid embedded structure, eliminating the NULL dereference.
Potential Impact
An attacker controlling a remote ASCS server can cause a denial of service on the local device by triggering a NULL pointer dereference and crash in the BAP unicast client. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has indicated a fix that repoints BAP QoS storage to a valid embedded structure, but no official patch or remediation level is provided in the available data. Users should monitor the Zephyr project advisories for an official fix and apply it once available.
CVE-2026-10593: memory-safety in zephyrproject zephyr
Description
The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_state() (subsys/bluetooth/audio/bap_unicast_client.c), the handler writes attacker-controlled QoS fields (interval, framing, phy, sdu, rtn, latency, pd) through the stream->qos pointer with only a stream != NULL guard. stream->qos is NULL for any stream that has been codec-configured via bt_bap_stream_config() but not yet added to a unicast group (it is set only by unicast_group_add_stream()). A malicious or buggy remote ASCS server, to which the local device is connected as a BAP unicast client, can send a GATT notification announcing the ASE has entered the QoS Configured state while the local endpoint is still in the Codec Configured state — a transition the dispatcher explicitly permits — during that window, causing a write through a NULL pointer and a crash (denial of service). The data written is itself remote-controlled. The defect shipped in v4.3.0 and v4.4.0 (and earlier). The fix re-points all BAP QoS storage to the always-valid embedded ep->qos struct, eliminating the NULL dereference.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles ASE state notifications from a remote ASCS server. Specifically, in the function unicast_client_ep_qos_state(), the handler writes attacker-controlled Quality of Service (QoS) fields through a stream->qos pointer that may be NULL if the stream has been codec-configured but not yet added to a unicast group. This results in a NULL pointer dereference and crash when a malicious or buggy remote ASCS server sends a GATT notification indicating the ASE has entered the QoS Configured state prematurely. The defect was present in Zephyr versions 4.3.0 and earlier. The fix involves redirecting all BAP QoS storage to a guaranteed valid embedded structure, eliminating the NULL dereference.
Potential Impact
An attacker controlling a remote ASCS server can cause a denial of service on the local device by triggering a NULL pointer dereference and crash in the BAP unicast client. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has indicated a fix that repoints BAP QoS storage to a valid embedded structure, but no official patch or remediation level is provided in the available data. Users should monitor the Zephyr project advisories for an official fix and apply it once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-01T21:19:25.050Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a40ac0127e9c79719547621
Added to database: 06/28/2026, 05:07:13 UTC
Last enriched: 07/15/2026, 10:44:32 UTC
Last updated: 08/11/2026, 12:41:08 UTC
Views: 90
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.